From ca5ad28a270e6ccf26074823bff85e4b42da549b Mon Sep 17 00:00:00 2001 From: Yosuke Shimizu Date: Thu, 17 Sep 2026 14:45:41 +0900 Subject: [PATCH] scep: keep the caps-driven signing hash within the wolfSSL build - pick_hash_oid() returns SHA512h only under WOLFSSL_SHA512 and SHA384h only under WOLFSSL_SHA384; otherwise it falls through to SHA256h. - test_scep_roundtrip enrolls twice more, once with caps.sha512 and once with caps.sha384 set on a copy of the fetched capabilities. Issue: F-8024 --- src/scep/scep_client.c | 4 ++++ tests/integration/test_scep_roundtrip.c | 18 ++++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/src/scep/scep_client.c b/src/scep/scep_client.c index a3892db..c3d33e1 100644 --- a/src/scep/scep_client.c +++ b/src/scep/scep_client.c @@ -370,10 +370,14 @@ static int pick_hash_oid(const WolfCertScepCaps* caps) { if (caps == NULL) return SHA256h; +#ifdef WOLFSSL_SHA512 if (caps->sha512) return SHA512h; +#endif +#ifdef WOLFSSL_SHA384 if (caps->sha384) return SHA384h; +#endif return SHA256h; } diff --git a/tests/integration/test_scep_roundtrip.c b/tests/integration/test_scep_roundtrip.c index a31a933..071ff3b 100644 --- a/tests/integration/test_scep_roundtrip.c +++ b/tests/integration/test_scep_roundtrip.c @@ -1185,6 +1185,24 @@ int main(void) fprintf(stderr, "SCEP rsa:4096 rc=%d (%s)\n", rc, wolfcert_strerror(rc)); REQUIRE(rc == WOLFCERT_OK); + /* ---- Caps-driven signing hash. A CA that advertises SHA-512 or SHA-384 + * must not push the client past the digests wolfSSL was built with. */ + WolfCertScepCaps caps_hash = caps; + WolfCertBuffer issued_hash = { 0 }; + + caps_hash.sha512 = 1; + REQUIRE(wolfcert_scep_pkcs_req(&cli, &caps_hash, ca_der->buffer, + ca_der->length, dk, csr.data, csr.len, + &issued_hash) == WOLFCERT_OK); + wolfcert_buffer_free(&issued_hash); + + caps_hash.sha512 = 0; + caps_hash.sha384 = 1; + REQUIRE(wolfcert_scep_pkcs_req(&cli, &caps_hash, ca_der->buffer, + ca_der->length, dk, csr.data, csr.len, + &issued_hash) == WOLFCERT_OK); + wolfcert_buffer_free(&issued_hash); + /* ---- Content-cipher override: explicit AES-256 and AES-128 both enroll. * Each half needs the cipher wolfSSL was actually built with; scep_prepare * returns WOLFCERT_ERR_UNSUPPORTED for one the library cannot do. */